Analysis
-
max time kernel
188s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03/10/2022, 20:11
General
-
Target
d7c999a4da5b1ea2e4ec23c1880a0bf1a1cca377b0120247393331cf9b3cecaa.xls
-
Size
262KB
-
MD5
3dc3c8b90b4f08c28fa4221f72d8aa90
-
SHA1
1a1bf20bc348c2314276d741b81ddf04a3870a1f
-
SHA256
d7c999a4da5b1ea2e4ec23c1880a0bf1a1cca377b0120247393331cf9b3cecaa
-
SHA512
089113256f4d7c29ea2aaee73e447fe51f503bac7edcefbc7e64194476a03bb2f5bcc415db17caccd9283c6d354039810c8aadace56cdb0c912f84a22ead3631
-
SSDEEP
3072:IDt32zBAhGR6IxZvRLb9zopH3reF+Rsjmn/QnQgkIHmCVdWnhx4lWZkb6F2XLExV:+sR1xZJLRzod7m+RsjmoBtZVd+KTj
Score
6/10
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d7c999a4da5b1ea2e4ec23c1880a0bf1a1cca377b0120247393331cf9b3cecaa.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 40442⤵
- Process spawned suspicious child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB